DVA-C02 Deployment Practice Question
A developer is deploying an application using AWS CloudFormation. The stack includes an Amazon RDS DB instance. To ensure secure credential management, which TWO actions should the developer take? (Choose TWO.)
⚠ Common exam trap
Many candidates confuse IAM database authentication (which handles user-level access) with master password management, or assume CloudFormation can auto-generate passwords for RDS, but neither is correct for securely setting the initial master password.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Systems Manager Parameter Store with a SecureString parameter for the password.
AWS Systems Manager Parameter Store with a SecureString parameter is correct because it allows you to securely store the RDS master password as an encrypted parameter and reference it in the CloudFormation template using the `resolve:ssm` or `resolve:ssm-secure` dynamic reference. This avoids hardcoding the password in the template or exposing it in plaintext, while still enabling automated deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Systems Manager Parameter Store with a SecureString parameter for the password.
Why this is correct
Using AWS Systems Manager Parameter Store with a SecureString parameter is a robust solution for storing sensitive data like passwords. SecureString parameters are encrypted at rest using AWS Key Management Service (KMS) and can be securely referenced within CloudFormation templates using dynamic references or `Fn::Sub` functions. This method ensures the password is never exposed in plain text within the template or CloudFormation console, adhering to security best practices for non-rotating secrets.
- ✓
Use AWS Secrets Manager to store the master password and reference it dynamically.
Why this is correct
AWS Secrets Manager provides a dedicated, highly secure service for storing, managing, and rotating database credentials, API keys, and other secrets. It integrates directly with CloudFormation through dynamic references or `Fn::GetSecretValue` to retrieve the password during deployment, ensuring it remains encrypted and out of the template. Secrets Manager also offers automatic rotation capabilities, enhancing the security posture by regularly changing the password without manual intervention.
- ✗
Hardcode the master password in the CloudFormation template.
Why it's wrong here
Hardcoding the master password directly into a CloudFormation template is a severe security vulnerability. The password would be visible in plain text within the template file, in version control systems, and in the CloudFormation console's template view and change sets. This practice exposes sensitive credentials to anyone with access to the template or CloudFormation stack details, making it a significant compliance and data breach risk.
- ✗
Use IAM database authentication to manage credentials.
Why it's wrong here
IAM database authentication allows users and applications to authenticate to supported databases (like Amazon RDS) using their AWS IAM credentials instead of traditional database passwords. While this enhances security by leveraging IAM roles and policies for access control, it is an authentication *method* for clients, not a secure storage solution for the database's *master password*. The initial master password for the database still needs to be securely provided and managed separately.
- ✗
Leave the master password empty so that CloudFormation generates a random password.
Why it's wrong here
CloudFormation does not possess an inherent capability to automatically generate random passwords for resource properties like a database master password if the field is left empty. If a required password parameter is omitted or left blank in a CloudFormation template, the deployment will fail with a validation error, indicating that a mandatory property is missing or invalid. Developers must explicitly provide or reference a secure password for such resources.
Visual reference
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.